CVE-2026-118460: AIS embedded private keys enable practitioner impersonation

Published Nov 9, 2026

Updated

Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.

Affected Software

1 affected component

AIS

Event History

Nov 9, 2026

CVE Published

via MITRE·11:48 AM

Data Sourced

via MITRE·11:48 AM

DescriptionWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs access to the embedded private keys and their shared password. With them, the attacker can sign practitioner assertions for arbitrary practitioner identifiers and request unauthorized practitioner tokens.

What is the likely impact of successful exploitation?

Successful exploitation enables impersonation of practitioners through unauthorized token requests. The provided data does not describe any availability impact.

CVE-2026-118460: AIS embedded private keys enable practitioner impersonation

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?